Although data augmentation methods tend to improve the performance under common synthetic corruptions [1]}, these augmentations are often ad hoc and may have substantial overlap with the corruptions evaluated at test time.
At the same time, there is a large amount of literature on adversarial training with \(\operatorname{\mathbf {\ell }}_p\) -bounded perturbations [2]}, [3]}.
Adversarial training emerged as a principled approach to improve the worst-case performance of the model against small \(\operatorname{\mathbf {\ell }}_p\)  perturbations.
However, common image corruptions have a very high \(\operatorname{\mathbf {\ell }}_p\)  distance from clean samples, so the utility of using \(\operatorname{\mathbf {\ell }}_p\)  adversarial training for them is not obvious.
This leads us to explore the following question:
